How long does this take to "learn"our emails? It kicked in on Friday and I've been releasing every email it seems from the quaratine. Once I release it it does seem to learn, mostly. But a first time email to a user and it's always held. It's running me ragged. Any help?

I understand I can disable it by putting the value to 0. I don't want to do that but I want to make sure I'm doing everything correctly.

I have also a created a white-to.txt with a list of only valid emails in our system to try and cut out a lot of unwanted junk. Is this advisable?

I would like some more info on this as well. I recently purchased the software and am testing it on 1 domain currenlty that received quite a bit of spam. So far the system has taken 10,000 emails and only 1,800 of them have been passed.

I have noticed that the Bayesian Filter stilll shows that everything is at 0% and passes the email that is clearly spam.

The Bayesian filter kicks in after SpamFilter has received and processed 5,000 good emails and 5,000 spam emails. Before those limits are reached, SpamFilter will only build its internal statistical database.

Please note that the statistical analysis only occurs after all other filters have failed to catch spam, so that even the the Bayesian filter becomes active, the number of emails it will block will be very small when compared to others.

As a comparison, the following shows the current number of emails blocked by the various filter on our own SpamFilter installation. You'll see that the Bayesian filter has a very low count, but that is normal as that simply means that all the other filters combined allowed 107 emails to slip thru...

64937 IP found in MAPS search16230 IP address is from a blacklisted country15726 SPF Sender Policy Framework match12604 Exceeded maximum number of RCPT TO9693 Invalid sender domain MX record6434 URL in email found in SURBL search3399 Keywords found in content588 Mail From and Mail To domains are equal486 IP blocked by honeypot entry395 Virus Found in email107 Statistical filter match9 Mail From and Mail To are equal1 Domain is in local blacklist file

But my problem is everything is coming in at 100%, tonight I'm still pulling out good emails. I can get some counts tomorrow (I'm at home now), but my quaratine DB is 175meg, (starts at 3800, ends about 18000), when I sort on the reject over half is the statistical 100% spam. so that's several thousand. My counts are

connections 82000, forwarded 9300, blocked 44700, attempts 40500.

This was an upgrade from a 2+ year old V 1.0. What am I missing. I guess I'd rather have it working less than more because of all the calls I'm getting.

Ok Stopped and reset this morning. Usual junk is flowing again. My Bays number on the pie chart was 6600. Not sure how to reset this but I did reset the main counters. Stuff showing 0% spam match getting through.

Any interest in checking out the corpus DB? It was full, lots of the tokens had the same number, many were different.

You can't directly modify the corpus database, but you can cheat... If you have the original, unmodified source of the emails that you received from them, you could forward them so that SpamFilter processes them again, ensuring that when you re-send them you are whitelisting them. This way the Bayesian filter will "learn" that they are good emails and will adapt. You should also make sure you force-delivery of the good quarantined emails as this will cause SF to "undo" the entries it added to the Baysian database, and will actually additionally update to "heavily mark" those tokens as good for the future.

Have you upgraded to the latest versions of SpamFilter? One of the most visible improvements in the new version is
a greater effectiveness of the Bayesian filter. Its spam catch rate has,
sometimes, increased 100-fold.

Per Dan's suggestion, Ive created a new corpus directory. Meanwhile some of the domains that are failing MX checks are elon.edu, aapa.org, and gci.net. Sorry I don't have the full headers at the moment. I went ahead and forced the messages through.

and lastly, three of these were caught. All of the above postings were just in the past six hours and were only to me (not being an actual ISP, it's jsut me and the missus using the clator.com domain).

Hopefully these will point to some issues. In case it hasn't been said, thanks for any help you can provide.

You cannot post new topics in this forumYou cannot reply to topics in this forumYou cannot delete your posts in this forumYou cannot edit your posts in this forumYou cannot create polls in this forumYou cannot vote in polls in this forum